Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Enter existing user namespace if present #187

Closed
wants to merge 1 commit into from
Closed

Enter existing user namespace if present #187

wants to merge 1 commit into from

Conversation

codido
Copy link
Contributor

@codido codido commented Aug 8, 2015

When executing an additional process in a container, all namespaces are
entered but the user namespace. As a result, the process may be
executed as the host's root user. This has both functionality and
security implications.

Fix this by adding the missing user namespace to the array of
namespaces.

When executing an additional process in a container, all namespaces are
entered but the user namespace. As a result, the process may be
executed as the host's root user. This has both functionality and
security implications.

Fix this by adding the missing user namespace to the array of
namespaces.

Signed-off-by: Ido Yariv <[email protected]>
@hqhq
Copy link
Contributor

hqhq commented Aug 10, 2015

I think we already handle user ns in golang implementation, and also, FYI #105 is modifying some mechanism.

@codido
Copy link
Contributor Author

codido commented Aug 10, 2015

#105 indeed fixes the issue I was seeing. If it's going to be merged, I can close this pull request.

@dqminh
Copy link
Contributor

dqminh commented Aug 10, 2015

i haven't look at #105 for a while :( I will try to give it some time this week. Generally #105 approach is the way to go i think, as init processes should also be able to share namespaces, not necessarily only exec-in processes.

@mrunalp
Copy link
Contributor

mrunalp commented Aug 10, 2015

Thanks for the PR @GitIdo. However, I think that we should close this in favor of #105

@mrunalp mrunalp closed this Aug 10, 2015
@codido codido deleted the nsenter_fix branch August 13, 2015 20:02
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

5 participants